You've been told you need MDR. Fair enough. But every provider on your shortlist uses the same three letters, promises '24/7 monitoring', and shows you a dashboard that looks broadly identical. So how do you actually tell them apart? This guide cuts through the sales gloss. We'll explain what Managed Detection and Response really delivers versus the EDR tool you might already own, what good round-the-clock monitoring looks like in practice, how pricing works, and the questions that separate a genuine security partner from a reseller with a logging portal.
What MDR actually delivers — versus EDR and a SOC
Let's define the terms in plain English before comparing anyone. EDR — Endpoint Detection and Response — is software that sits on your laptops and servers, spots suspicious behaviour, and gives you the ability to isolate a machine. Think of it as a very good smoke detector. It's the tool. It doesn't decide what to do when the alarm goes off.
A SOC — Security Operations Centre — is a team of analysts watching those alarms. MDR is the service that wraps the two together: technology plus humans plus a defined response, delivered as an outcome rather than a product. The distinction that matters most is response. Plenty of vendors 'detect and notify'. Genuine managed detection and response contains the threat — isolating a device, disabling an account, killing a process — often before anyone on your side has read the email.
So the useful comparison isn't 'MDR vs EDR' as competing purchases. Good MDR usually includes or integrates with an endpoint security (EDR) platform, and increasingly pulls in identity, email and network signals too. If a provider only watches endpoints, they're selling managed EDR — perfectly valid, but narrower than the MDR label implies.
How to evaluate UK MDR providers: coverage, response times and evidence
Start with coverage. Ask exactly what telemetry the service ingests: endpoints only, or also Microsoft 365 and Entra ID sign-ins, firewall and network security logs, and cloud workloads? An attacker who phishes a password and logs into email legitimately won't trip an endpoint tool. Broader coverage catches more of the attack chain.
Then pin down response — and get it in writing. There's a world of difference between 'we'll alert you within 15 minutes' and 'we'll contain the threat within 15 minutes'. Ask for the specific actions the provider is authorised and able to take on your behalf, and whether that authority runs 24/7 or drops to 'business hours' at 6pm on a Friday. Attackers know when your team clocks off.
Finally, demand evidence rather than adjectives. Any credible provider should show you a redacted real investigation, sample monthly reporting, and their measured detection and response times — not a marketing figure. Ask how they tune out false positives, because an MDR service that cries wolf will be ignored within a month.
- What data sources are monitored — endpoint, identity, email, network, cloud?
- Is response 'notify only' or 'active containment', and who authorises it?
- Are response commitments genuine SLAs with penalties, or aspirations?
- Can they show a real (redacted) incident from detection to closure?
- Do humans review alerts overnight, or does the queue just wait until morning?
What does good 24/7 monitoring look like?
'24/7 monitoring' is the most abused phrase in this market, so interrogate it. The weak version is a tool running around the clock while the analysts who read its output work 9-to-5. Alerts pile up overnight and someone triages them with their morning coffee. Technically true. Practically useless against a ransomware crew that deliberately detonates at 3am on a bank holiday.
Good 24/7 monitoring means a staffed managed SIEM and SOC with analysts actually watching and acting at every hour, backed by playbooks so response doesn't depend on one clever individual being awake. Ask whether the SOC is UK-based, follow-the-sun across regions, or a single overnight skeleton crew — and whether the person who picks up at 3am can actually contain a threat or only log a ticket.
Push on the handoff too. When something serious happens overnight, how do they reach you? Do they phone a named contact, or send an email you'll see at nine? And crucially, what have they already done by the time you answer? The best services have already isolated the affected machine and are talking you through recovery, not asking permission to start.
MDR pricing models and what drives cost
MDR is usually priced per endpoint or per user per month, sometimes with a separate charge for each additional data source such as identity or firewall logs. Per-user pricing tends to be cleaner for office-based teams; per-endpoint suits server-heavy or industrial environments. Watch for providers who price cheaply per seat then charge extra for the very log sources that make the service worthwhile.
Several things genuinely drive cost: the breadth of telemetry ingested and stored, log retention period (compliance may require twelve months or more), whether active response is included or an add-on, and whether incident response hours during a real breach are covered or billed separately. A very low headline price often means 'alerting only' with a hefty day-rate when things actually go wrong.
Compare on total cost for a realistic scenario, not the per-seat sticker. Model what you'd pay in a genuine incident — the moment you most need the service to just work. If containment, forensics and out-of-hours response all sit outside the base fee, the cheap quote isn't cheap. Our team can help you sanity-check quotes; get in touch if you want a second opinion on a proposal.
Onboarding an MDR service without disrupting your team
A good onboarding is boring — and that's the point. Deploying agents and connecting log sources shouldn't take your systems offline or generate a fortnight of chaos. Ask providers to walk you through their rollout: how agents are deployed (ideally through your existing management tooling), how long the 'tuning' period lasts, and what your team needs to do versus what they handle.
Expect a baseline period of a few weeks where the service learns what normal looks like in your environment. During this window false positives are higher, so a provider who tunes aggressively and communicates clearly saves you a lot of noise. If you run a lean internal team, look for a co-managed IT support arrangement where the MDR provider and your staff share clearly defined responsibilities rather than tripping over each other.
Clarify the escalation path from day one. Who on your side gets called, in what order, and what decisions has the provider been pre-authorised to make? Agreeing this before an incident — not during one — is the single biggest predictor of a calm response. Tie it into your wider cyber security plan so MDR isn't a bolt-on but part of a coherent defence.
Choosing an MDR partner that fits UK compliance needs
Where your data lives matters. If you're bound by UK GDPR, Cyber Essentials Plus requirements, or sector rules in finance, legal or healthcare, ask where logs are stored and processed, and whether that's UK or EU based. A US-headquartered platform isn't automatically a problem, but you need to know and document it for your own compliance records.
Retention is the other compliance lever. Many frameworks and cyber insurers now expect you to retain security logs for a defined period and to demonstrate active monitoring. Check the provider's default retention, what longer retention costs, and whether their reporting is detailed enough to satisfy an auditor or an insurer's post-incident questions. Vague monthly summaries won't cut it when a claim is being assessed.
Finally, weigh the relationship. An MDR partner should feel like an extension of your team — reachable, straight-talking, and willing to explain findings without hiding behind jargon. If you already work with a provider for managed IT support, a joined-up approach means faster containment because the people watching for threats also understand how your systems fit together. Read our other resources and guides before you commit to a shortlist.